Consider a scenario that plays out constantly at small companies: a 60-person manufacturing firm discovers that someone has been inside their email system for three weeks. The attacker isn't a nation-state group. It's an opportunistic criminal who bought an office manager's credentials off a dark web dump for a few dollars. According to the 2025 Verizon Data Breach Investigations Report, 54% of ransomware victims had credentials previously exposed in infostealer logs, and stolen credentials remain the most common initial access vector in breaches.
That's the reality for small businesses. You're not being targeted because you're important. You're being targeted because you're easy.
The breaches that hit small companies almost never involve clever hacking. They involve basic, fixable gaps that nobody got around to closing. Here are the five that show up over and over again.
1. Not Enforcing Multi-Factor Authentication
MFA is still the single highest-impact security control you can implement, yet many companies still don't have it turned on. According to CISA, enabling MFA makes accounts 99% less likely to be compromised. Despite this, the reason it's missing is often some version of "we started rolling it out but some people pushed back and we dropped it."
Here's what people miss: MFA doesn't just protect against stolen passwords. It also protects you when an employee reuses their work password on a site that gets breached, which happens constantly. Without MFA, that breach becomes your breach.
A common pattern is that companies enable MFA on email but skip their cloud storage, HR system, or accounting software. Attackers know this. They go after the unprotected apps first.
Fix it now: Enable MFA on every business application that supports it, not just email. Most platforms include it at no extra cost. Make it mandatory, not optional. Yes, some people will complain. That's fine.
2. Relying on Weak or Reused Passwords
Everyone knows passwords are a problem. But the nuance most small businesses miss is that password policies alone don't work. Telling people to create "complex" passwords just produces predictable patterns — capital letter at the start, number and symbol at the end, same base word every quarter.
The real fix is removing the burden entirely. A password manager generates and stores strong, unique passwords so employees don't have to think about it. Research compiled by the Ponemon Institute indicates that password management tools can reduce the risk of credential-related breaches by 30-50%, and organizations consistently report significant drops in password-related support tickets after deployment.
Fix it now: Deploy a business password manager. Pair it with MFA. Those two controls together stop the vast majority of credential-based attacks, which account for the bulk of small business breaches.
3. Having No Incident Response Plan
This is the mistake that turns a bad day into a catastrophic one. According to IBM's Cost of a Data Breach Report, organizations without a formal incident response plan pay 58% more per breach than those with tested response protocols. Breaches that could be contained in hours instead spiral for weeks because nobody knows who is supposed to do what.
A typical scenario looks like this: a company has a vague understanding that "IT handles security stuff," but when something actually happens, the IT person is overwhelmed, the CEO is making calls to the wrong people, and the company's lawyer doesn't find out until day three. Meanwhile, the attacker is still inside.
Your incident response plan doesn't need to be long. It needs to exist, and your leadership team needs to have walked through it at least once.
Fix it now: Write a one-page plan that covers: who's in charge, who to call (legal, insurance, forensics), how to contain the damage, and how to communicate externally. Then run a 30-minute tabletop exercise. Industry experience consistently shows that the first exercise always reveals gaps nobody expected — which is exactly why only 30% of organizations that have plans actually test them, according to Ponemon Institute research.
4. Treating Security Training as a Compliance Checkbox
Annual security training is almost worthless for actually changing behavior. People sit through it, click "next" until it's done, and forget everything by the following week. A common mistake CEOs make here is assuming that because they bought a training platform, the problem is solved.
What actually works is short, frequent reinforcement combined with simulated phishing that gives people practice recognizing attacks. According to KnowBe4's 2025 research, organizations that implement regular security awareness training reduce phishing click rates by 86% over 12 months. The companies that make real progress run brief monthly modules — five minutes, not an hour — and quarterly phishing simulations. They track who clicks, coach repeat offenders privately, and share improvement metrics with the whole team.
The Real Risk
Untrained employees don't just fall for phishing. They also mishandle sensitive data, use unauthorized applications, share credentials, and fail to report suspicious activity. Training addresses all of these risks, not just email threats.
Fix it now: Set up monthly micro-training and quarterly phishing simulations. Track metrics over time. If your click rate on simulated phishing isn't dropping, change your approach — don't just keep running the same program.
5. Not Testing Backups
Having backups and having usable backups are two completely different things. According to a report from At-Bay, more than 1 in 4 businesses fail to restore data from backups when hit by a ransomware attack. Sophos research found that 94% of ransomware attacks attempt to compromise backup repositories, and 75% of victims lose at least some of their backups. Companies discover too late that backups haven't been completing successfully for months, or they're stored on the same network the ransomware just encrypted.
The question you need to answer isn't "do we back up our data?" It's "if we lost everything tomorrow morning, how long would it take to be operational again, and are we sure that number is right?"
Fix it now: Test a full restoration from backup at least quarterly. Make sure at least one copy is stored offline or in an isolated environment that ransomware can't reach from your production network. Document your actual recovery time — not the theoretical one, the measured one.
The Bottom Line
None of these fixes require a massive budget or a dedicated security team. They require someone deciding they're a priority and following through. Industry data consistently shows that the companies that get breached rarely lack resources — they lack focus on the basics. The 2025 Verizon DBIR found that the majority of breaches still exploit fundamental gaps like stolen credentials and phishing, not advanced techniques.
For a more complete framework on building security into your business strategy, check out Cybersecurity for CEOs.